Skip to content

antony@notes:~/rancher$ cat "Install-Minio-with-Rancher-Application-Collection.md"

Install Minio with Rancher Application Collection

2026-03-09· rancher

Install Minio with Rancher Application Collection

Prepare

  1. helm login Rancher Application Collection

    helm registry login dp.apps.rancher.io \
  -u <user> \
  -p <password>

  2. download helm chart

    helm pull oci://dp.apps.rancher.io/charts/minio --version 5.4.0

  3. Create Namespace

    kubectl create ns minio

  4. 建立 Image Pull Secret

    kubectl -n minio create secret docker-registry application-collection \
  --docker-server=dp.apps.rancher.io \
  --docker-username=<user> \
  --docker-password=<password>

  5. 確認已安裝 Ingress Controller 和 StorageClass (本篇文章用的是 Nginx 和 local-path)

    • 確認當前 K8s 叢集的 Ingress Controller

      kubectl get ingressclasses.networking.k8s.io

      執行結果：

      NAME    CONTROLLER             PARAMETERS   AGE
nginx   k8s.io/ingress-nginx   <none>       7d

    • 確認當前 K8s 叢集的 StorageClass

      kubectl get sc local-path

      執行結果：

      NAME                   PROVISIONER             RECLAIMPOLICY   VOLUMEBINDINGMODE      ALLOWVOLUMEEXPANSION   AGE
local-path (default)   rancher.io/local-path   Delete          WaitForFirstConsumer   false                  6d3h

  6. 確認已安裝 Cert-manager

    kubectl -n cert-manager get pods

    執行結果：

    NAME                                       READY   STATUS    RESTARTS   AGE
cert-manager-578bff8c75-ms6hw              1/1     Running   0          41m
cert-manager-cainjector-566b8f9766-pxnlb   1/1     Running   0          41m
cert-manager-webhook-c9997c6b5-94fsj       1/1     Running   0          41m

Deploy

  1. 解壓縮 minio chart

    tar -zxvf minio-5.4.0.tgz; cd minio

  2. 定義 MinIO 自簽憑證的簽發架構

    mkdir cert-manager/; vim minio-pki-bootstrap.yaml

    檔案內容如下：

    apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: selfsigned-issuer
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: selfsigned-ca
  namespace: minio
spec:
  isCA: true
  commonName: selfsigned-ca
  secretName: root-secret
  privateKey:
    algorithm: ECDSA
    size: 256
  issuerRef:
    name: selfsigned-issuer
    kind: ClusterIssuer
    group: cert-manager.io
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: ca-issuer
  namespace: minio
spec:
  ca:
    secretName: root-secret

    檔案包含三個資源：

    • ClusterIssuer（自簽發行者）
    • Certificate（作為 Root CA 的自簽憑證，使用 ECDSA P-256 演算法，並將私鑰跟憑證都存入 Secret root-secret）
    • 以及 Issuer（引用該 Root CA 來簽發後續憑證）

  3. 將上述資源套用至叢集，Cert-manager 會自動產生 Root CA 憑證與私鑰，並建立可用於 minio namespace 中後續憑證簽發的 CA Issuer。

    kubectl apply -f cert-manager/minio-pki-bootstrap.yaml

  4. 撰寫 minio values.yaml

    vim custom-values.yaml

    檔案內容如下：

    global:
  imagePullSecrets:
  - application-collection
mode: standalone
persistence:
  size: 5Gi
resources:
  requests:
    memory: 512Mi
rootPassword: admin123
rootUser: admin
ingress:
  enabled: true
  ingressClassName: nginx
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: "0"
    cert-manager.io/issuer: ca-issuer
  path: /
  hosts:
    - api.minio.kubeantony.com
  tls:
    - secretName: minio-api-tls
      hosts:
        - api.minio.kubeantony.com
consoleIngress:
  enabled: true
  ingressClassName: nginx
  annotations:
    cert-manager.io/issuer: ca-issuer
  path: /
  hosts:
    - console.minio.kubeantony.com
  tls:
    - secretName: minio-console-tls
      hosts:
        - console.minio.kubeantony.com

  5. 部署 Minio

    helm -n minio upgrade --install minio . -f custom-values.yaml

    執行結果：

    Release "minio" has been upgraded. Happy Helming!
NAME: minio
LAST DEPLOYED: Mon Mar  9 14:40:55 2026
NAMESPACE: minio
STATUS: deployed
REVISION: 9
TEST SUITE: None
NOTES:
MinIO can be accessed via port 9000 on the following DNS name from within your cluster:
minio.minio.cluster.local

To access MinIO from localhost, run the below commands:

  1. export POD_NAME=$(kubectl get pods --namespace minio -l "release=minio" -o jsonpath="{.items[0].metadata.name}")

  2. kubectl port-forward $POD_NAME 9000 --namespace minio

Read more about port forwarding here: http://kubernetes.io/docs/user-guide/kubectl/kubectl_port-forward/

You can now access MinIO server on http://localhost:9000. Follow the below steps to connect to MinIO server with mc client:

  1. Download the MinIO mc client - https://min.io/docs/minio/linux/reference/minio-mc.html#quickstart

  2. export MC_HOST_minio-local=http://$(kubectl get secret --namespace minio minio -o jsonpath="{.data.rootUser}" | base64 --decode):$(kubectl get secret --namespace minio minio -o jsonpath="{.data.rootPassword}" | base64 --decode)@localhost:9000

  3. mc ls minio-local

  6. 確認 Minio Pods 有正常運作

    kubectl -n minio get pods

    執行結果：

    NAME                     READY   STATUS    RESTARTS   AGE
minio-7f67bcc94c-7hcc5   1/1     Running   0          3h58m

  7. 查看 Ingress

    kubectl -n minio get ing

    執行結果：

    NAME            CLASS   HOSTS                          ADDRESS                                        PORTS     AGE
minio           nginx   api.minio.kubeantony.com       192.168.11.154,192.168.11.155,192.168.11.156   80, 443   3h52m
minio-console   nginx   console.minio.kubeantony.com   192.168.11.154,192.168.11.155,192.168.11.156   80, 443   3h29m

  8. 打開瀏覽器，連線至 Minio 管理網站

    https://console.minio.kubeantony.com/

    確認打開瀏覽器的電腦能透過 DNS 解析 Minio FQDN 的 IP

    image

Install Prometheus with Rancher Application CollectionGrafana Reporter 部署指南（Harvester / Rancher 環境）